Public Comments: April 2009 – Request for declaration regarding fairness of opt-out methods and investigation into Acxiom, US Search, PublicRecordsNow, and USA People Search consumer opt-out methods for compliance with Section 5 of the FTC Act, 15 U.S.C. § 45(a)(1)

or Read comments below

Re: Request for declaration regarding fairness of opt-out methods and investigation into Acxiom, US Search, PublicRecordsNow, and USA People Search consumer opt-out methods for compliance with Section 5 of the FTC Act, 15 U.S.C. § 45(a)(1).

Dear Commissioners,

The Commission has laid down specific examples of what constitutes unreasonable opt- out procedures, particularly in its Affiliate Marketing Rule, which describes three distinct types of opt-out methods the Commission considers to be unreasonable. Some companies are ignoring the standards the Commission has set, and are requiring consumers whom they have notified online of an opt-out opportunity to then use paper and postal mail processes to accomplish the opt out.

To the greatest extent possible, consumers should be able to conduct Internet-based activities wholly on the Internet. Requiring Internet consumers to use paper forms and postal mail to opt out after being given notice of opt out entirely online is unreasonable today.

For example, PublicRecordsNow [1] and USA People Search [2] are commercial databrokers that offer consumers the ability to opt out of the display of some of their records on their respective websites. The website opt-out notice for PublicRecordsNow requires consumers to write their own letter and mail it to opt out. [3] USA People Search similarly notifies consumers online of its opt out, then requires consumers to write a paper letter and mail it to opt out. [4]

Acxiom [5] is a commercial databroker that offers consumers selective opt outs from its products and databases. For one of its opt outs, Acxiom notifies consumers online of its opt out, then requires consumers to either call or make a written request to receive an opt-out form. After making the request, the consumer is “snail” mailed an opt-out form, which the consumer sends via return mail to opt out. The actual opt-out form is not included on the page or website with the opt-out notice. [6]

US Search [7] is a commercial databroker that offers consumers the ability to opt out of having some of their information displayed on the US Search website. US Search requires consumers to fill in its online form, print out the form, and mail a copy to opt out. [8] There is no opt out available online.

Section 5 of the FTC Act states: “Unfair methods of competition in or affecting commerce, and unfair or deceptive acts or practices in or affecting commerce, are declared unlawful.” 15 U.S. C. § 45(a)(1).

In its Policy Statement on Unfairness, [9] the Commission identified three factors that it considers when applying the prohibition against consumer unfairness:

1. Whether the practice injures consumers

2. Whether it violates established public policy

3. Whether it is unethical or unscrupulous

The World Privacy Forum [10] believes the cited opt-out methods at Acxiom, PublicRecordsNow, USA People Search, and US Search are unfair according to the standards established by the Commission. The opt outs are discussed in more detail below. Further descriptions and screen shots of the specific opt-out methods are included in an appendix to this letter.

I. The Opt-out Methods Violate Established Public Policy

The Acxiom, PublicRecordsNow, USA People Search, and the US Search opt-out methods described in this letter are unfair because they violate established public policy.

First, the Commission’s Affiliate Marketing Rule [11] clarifies what is and is not a reasonable opt out. The companies named in this letter have opt-out methods that qualify as unreasonable under one or more of the Affiliate Marketing Rule’s standards. Second, current best industry practice is to supply consumers with an online opt-out along with other forms of opt out.

The FTC Policy Statement on Unfairness states: “Sometimes public policy will independently support a Commission action. This occurs when the policy is so clear that it will entirely determine the question of consumer injury, so there is little need for separate analysis by the Commission.” We discuss each point of how the cited opt outs are unfair below. We can state here that established public policy is so clear as to indeed allow the Commission to determine the question of consumer harm entirely on this basis.

FACTA rulemaking on opt outs

The Commission published its final Affiliate Marketing Rule for FACTA October 30, 2007. [12] In Section 680.25, the final rule definitively illustrates that it is not reasonable or simple to require a consumer who receives an opt-out notice through posting at an Internet website to opt out solely by paper mail. The rulemaking offers other examples of unreasonable opt outs. [13]

Section 680.25 of the Affiliate Marketing Rule addresses reasonable and simple methods of opting out. The rule states a reasonable and simple method of opt out includes:

(a)(iii) Providing an electronic means to opt out, such as a form that can be electronically mailed or processed at an Internet Web site, if the consumer agrees to the electronic delivery of the information;

In describing unreasonable examples of opt out, the same section also provides:

(b)(2) Opt-out methods that are not reasonable and simple. Reasonable and simple methods for exercising an opt-out right do not include –

(i) Requiring the consumer to write his or her own letter;

(ii) Requiring the consumer to call or write to obtain a form for opting out, rather than including the form with the opt-out notice;

(iii) Requiring the consumer who receives the opt-out notice in electronic form only, such as through posting at an Internet Web site, to opt out solely by paper mail or by visiting a different Web site without providing a link to that site.

The companies named in this letter offer methods for exercising an opt out that are not reasonable in the follow ways:

PublicRecordsNow and USA People Search each provide an opt-out notice through their respective websites. Both companies require the consumer to write his or her own letter. [14] Requiring the consumer to write his or her own letter is an unreasonable opt out according to (b)(2)(i).

Acxiom provides an opt-out notice on its website. Acxiom requires the consumer to call or fill in an online form to obtain a form for opting out via postal mail, rather than including the form with the online opt-out notice. [15] Requiring a consumer to call or write to obtain a form for opting out, rather than making the form accessible through the opt-out notice itself is an unreasonable opt out according to (b)(2)(ii).

US Search’s website provides notice of opt out and an opt-out form that is accessible online. It then requires consumers to fill out the form online, print the form, and then opt out by snail-mailing the paper form. [16] Requiring a consumer who receives the opt-out notice on an Internet Web site to opt out solely by paper mail is an unreasonable opt out according to (b)(2)(iii).

The FACTA Affiliate Marketing Rule [17] reflects the Commission’s recent thinking on reasonableness in online opt-out standards. While the FACTA rulemaking technically applies directly only to FACTA activities, it is difficult to find a reason why the same principles would not apply broadly to other websites. A consumer opt out is a consumer opt out. The application of different standards to different websites that appear substantially identical to consumers makes little sense here, at least in the absence of express legal requirements or a compelling circumstance.

Thus, we find it irrelevant that, for example, US Search states in its Terms of Use that it is “intended for personal use only,” which would exempt the site from being regulated under FACTA. [18] The Commission’s standards on the reasonableness of opt-out mechanisms should apply just as well to these companies’ non-FACTA opt outs.

Industry best practice today affirms the public policy the Commission articulated in its FACTA Affiliate Marketing rulemaking. Significant competitors to the companies named in this letter offer online opt outs that in fact do meet the Commission’s standards of a reasonable opt out.

Here is a brief list, not exhaustive, of competitors to the companies named in this letter, and others, offering online opt outs:

Although not a competitor, it is worth noting that the Do Not Call list, which despite the complexity of the need to authenticate consumers for an online form of opt out, still offers an online opt-out: <https://www.donotcall.gov/>.

We believe public policy as articulated in the Commission’s Affiliate Marketing Rule and as generally practiced by industry regarding online consumer opt outs has evolved to the point that it is now an unambiguous public policy. This clear public policy, on its own, is enough to establish consumer harm and the unfairness of the cited opt-out methods.

II. The Opt-out Methods Injure Consumers

The opt-out methods in question injure consumers because they impose a substantial injury, and because consumers cannot avoid the injury.

The injury is substantial

The cited opt-out methods are harmful because they meet the Commission’s definition of substantial harm to consumers. The Commission states that a consumer injury is substantial if, among other things, it poses safety risks: “Unwarranted health and safety risks may also support a finding of unfairness.” [20]The Commission also states that an injury is substantial if it “does a small harm to a large number of people.” [21] We believe these opt outs pose substantial harms to certain groups of consumers, and small harms to a large number of consumers.

Consumers with safety considerations are substantially harmed

Groups of consumers who have safety considerations need timely and the fastest opt-out methods practicable to prevent potentially substantial harm and to ensure their safety. For these groups of consumers, the injury that unreasonable opt-out methods pose to them may be greater and more immediate. Victims of domestic violence or stalking, and other individuals who may have pressing reasons to remove themselves from public databases or website displays of personal information encounter unnecessary delays from opt-outs that must be sent by postal mail. In these situations, the potential for consumer harm is significant enough on its own to merit Commission action on consumers’ behalf.

This is not a theoretical concern. A victim of stalking, for example, wrote to the FTC [22] asking for “immediate help” in getting opted out from the US Search database, a process the consumer had already attempted to complete at least once prior to contacting the Commission. [23] A requirement from a website for a postal mail-only-opt out is unfair to all consumers, but the additional unfairness to this group of consumers is sufficient on its own to condemn the practice.

Multiple law enforcement officers, for example, have written to the FTC regarding various websites that display public record information to the public, citing special safety concerns regarding opt outs. A detective from California writing about Zabasearch.com said, “I am a Detective for the [xxx] Police Dept., and as you can probably guess I don’t want the criminals that I have put away having such easy access to my personal information.” [24]

Another law enforcement officer wrote: “I do not want public, publicly available and non-public information available about me available on the internet. I am in law enforcement and it is scary that by typing in my name they obtain my HOME address! [25]

Another consumer told the FTC that the web site of USAPeopleSearch and Zabasearch “is an invasion of privacy and unsafe for consumers.” [26]

Consumers may be deterred from exercising an opt out due to barriers imposed by the cited opt-out methods

The injury is also substantial because many consumers have effectively been either entirely dissuaded from opting out, or consumers have had difficulty opting out by the unreasonable methods required. Consumers have told the FTC that opting out is not easy for them. A consumer complained specifically about US Search, stating: “I opted out from their database a year ago. I was told that the non-public record will be suppressed and I also was told by their customer service that there is no way that they can sell my information once I am in [the] opt-out program. … Today I ran [a] search on myself and it turned out that my information is still being sold, and it looks like they are also using the information I provided when I signed up for the opt-out program.” [27]

Another consumer wrote: “US Search at ussearch.com provides personal information about individuals including phone number and address. US Search offers individuals the opportunity to “opt-out” of their database. However, even after you have opted out, US Search will provide information about you (address, phone number). … Consumers should have a way to prevent US Search from providing information about them.” [28]

One New York consumer who contacted the FTC about US Search was “not happy with having to contact the individual companies online and opt out of information sharing. The consumer was provided with the opt-ing [sic] out procedures and she was not happy with that.” [29] It is difficult enough to opt out. But adding a postal mail requirement to the mix raises the hurdle to potentially insurmountable levels for some consumers.

Consumers have written to the FTC about their attempts to opt out, and have mentioned their attempted use of email to opt out. One consumer wrote: “I asked for my information to be removed from the US Search web site, and I also opted out in writing. Access to my info was temporarily disabled, but as of today is available again on the site. … I want my information permanently removed from this web site. I have sent another request to the company (via email) to do so.” [30]

A consumer wrote about trying to opt out at peoplefinders.com. We include the complaint here because it is again indicative of how some consumers are communicating their desire to opt out to companies. The consumer wrote: “I have been an identity theft victim a few years back. It is very scary to find out that it is relatively easy to get personal information on anyone. Is this what we have to pay for in the case of living in a high-tech society? I have sent an email to the company to have my name removed, if it even works.” [31] Our point is that these consumers were comfortable sending email to opt out. We are not persuaded that very many consumers would turn as quickly to sending a paper letter through the postal mail as a first-choice option.

The additional burden imposed on consumers by a website’s insistence on the use of postal mail in the opt-out process is plainly unfair. For a website that conducts all or substantially all of its activities online to suddenly revert to “snail mail” for an activity that it might want to discourage is dishonorable. It denies the nature, convenience, and efficiency of the Internet as an online medium. Why do these websites insist on the use of postal mail for all or part of their opt-out methods, when so much of their business is conducted online? If postal mail is such a good method for opting out, why do so few — if any — websites use postal mail methods when they ask consumers to opt in to something?

Postal mail opt-out methods in the context of consumer choice allow websites to have their cake and eat it too. Websites can say to regulators and legislators that they are indeed offering opt outs. However, the sites have established requirements that unfairly discourage consumers who are interested in opt outs from pursuing those interests.

In some cases, this is a small harm to a large number of consumers. But in other cases, such as for victims of stalking, or for individuals with jobs in law enforcement, the barriers to opting out presents safety issues, particularly when those opt outs are delayed unnecessarily by unreasonable opt-out methods, such as asking consumers to write their own letter and mail it in, among the other unreasonable opt-out methods the FTC has articulated in its Affiliate Marketing standards.

Consumers cannot reasonably avoid the injury

Consumers cannot evade the injury the unreasonable opt-out methods create. With the US Search opt-out method, for example, consumers have no ability to “vote with their feet” and simply go to another company with better practices. US Search collects data on consumers and disseminates it. To remove their information from this specific website, consumers must find the company, understand its activities, and use the company-established opt-out process. As discussed, that process, due to its reliance on postal mail, can take time. One consumer from Colorado Springs specifically wrote in about US Search and stated that she or he had sent the opt-out letter in June, but that as of July, that his or her information was still accessible online. The consumer wrote: “This is really unacceptable…” [32]

While other similar databrokers offer a variety of forms of opt-out – including opt outs that can be accomplished entirely online [33]– consumers who avail themselves of these and other opt outs have not necessarily opted out of the information being displayed on the US Search website.

How many consumers have visited the web page of the PublicRecordsNow, USA People Search, US Search, and Acxiom, found the opt-out notices, and not followed through because the hurdle for opting out was too high for them? An opt-out procedure that requires the consumer to mail in a paper opt-out, request a paper opt-out form, and in some cases also write and mail a letter, unreasonably creates an obstacle to the free exercise of consumer decision-making. There is no doubt that many individuals find these requirements overly burdensome.

The World Privacy Forum believes that, absent specific and compelling circumstances or express legal requirements, consumers should be able to exercise a website opt out completely through the website in question. We do not object to supplementing online opt outs with mail and telephone options.

III. Unethical or Unscrupulous Conduct

The Commission’s Policy Statement on Unfairness discusses the duplicative quality of the third test, unethical or unscrupulous conduct, stating “Conduct that is truly unethical or unscrupulous will almost always injure consumers or violate public policy as well.” [34] The Statement further notes that the Commission will act in the future only on the basis of the first two tests. As such, this document discusses only the first two tests.

IV. Conclusion and Request

The requirement by Acxiom, US Search, PublicRecordsNow, and USA People Search that website visitors seeking to opt out must use postal mail as part of the required opt-out method is unfair and unlawful. The opt-out methods cited in this letter meet one or more of the specific unfairness standards set out by the Commission. These opt-out methods violate established public policy and harm consumers.

We restate that the established public policy is so clear as to allow the Commission to determine the question of consumer harm expeditiously and without any major inquiry.

Because the harm is clear, because consumers have already been harmed, and because the harm is continuing, we ask the Commission first and foremost to make a prompt, general, and public declaration rejecting postal mail-only opt-out methods for companies giving opt-out notice via websites.

We additionally ask that the Commission investigate the postal-mail opt-out policies of Acxiom, US Search, PublicRecordsNow and USA People Search [35] described in this letter and find them to be unfair and unlawful. [36]

We look forward to hearing from you regarding this matter. Please contact us if we can provide more information to you.

[13] Section 680.25 of the Affiliate Marketing Rule corresponds to a provision in the Privacy of Consumer Financial Information Rule, 16 CFR § 313.7 (a)(2)(iv). This rule resulted from the 1999 Gramm-Leach-Bliley Act, which, among other things, established a limited consumer right to opt-out of some information sharing in the financial sector. The 2007 FACTA Affiliate Marketing rulemaking on opt out properly adjusted the GLB opt-out language slightly to incorporate the development of the Internet during the intervening years as a core business and consumer communication medium.

[19] ChoicePoint, a competitor to Acxiom, offers an opt-out to a similarly complex product, except that ChoicePoint includes the required form with the opt-out notice (see http://www.privacyatchoicepoint.com/optout_ext.html), and ChoicePoint’s opt out can be done completely online if a consumer wishes to do so. (This is referring to the ChoicePoint-owned Direct Marketing Services Databases opt out.) Because ChoicePoint includes the actual opt-out form along with the opt-out notice, and because ChoicePoint provides consumers with the opportunity to submit the entire opt out online, the ChoicePoint procedure allows a consumer to opt out without reverting to the use of postal mail. The ChoicePoint KnowX opt-out procedure may be done online as well, but is more complex. (See http://www.privacyatchoicepoint.com/optout_ext_pfg.html).

[22] We quote from a number of consumer complaints made to the FTC in this letter. The consumer complaints are quoted here because consumer opinions and perceptions of how they have been treated have value and are an important consideration.

[23] FTC Consumer Sentinel, Ref. No. 4497734.

[24] FTC Consumer Sentinel, Ref. No. 5925746. This entry refers to Zabasearch.com. We believe the complaint is of general enough concern to include it here due to the similarity of the web site functions.

[25] FTC Consumer Sentinel, Ref. No. 6049433. This entry refers to “Zabasearch.com and other internet web sites.” We believe the complaint is of general enough concern to include it here due to the similarity of the web site functions.

[35] USA People Search posts its opt-out policy under a link that says “Help.” At the time of writing, neither its privacy policy nor its terms and conditions disclosed opt-out instructions to consumers. We observe that the lack of a clearly identified and of an easy-to-find opt-out link is a poor business practice that poses an additional hurdle for consumers.

[36] We do not include the issue of the cost of opt outs in this letter. Current best practice is offering an online opt out available at no charge. ChoicePoint, among other commercial data brokers, offers free online opt outs. We note that the Direct Marketing Association, which used to charge a small fee for its online opt outs, now offers online opt outs without cost. There are a few outliers. For example, Zaba Search (www.zabasearch.com) offers an electronic opt out and a mail-in-opt out. At this time Zaba Search charges $20 for its electronic opt out, it does not charge a fee for its mail-in-opt out. See <https://www.zabasearch.com/block_records/opt-out-services.php>. Also, the scope of Zaba Search’s opt out varies depending whether a fee is paid. Whether it is reasonable to charge a fee to a consumer who seeks to opt out online is an issue for another day.

Appendix I. Opt-out Mechanisms and Methods

Websites change frequently. We recorded the screenshots of the opt outs discussed in this letter to factually document the opt-out methods as of the time of writing. Dates of the screenshots are included in the figure captions.

A. Acxiom Opt Out

Acxiom directs consumers to a general opt-out page that offers a notice of opt-out rights and a link to an online form for requesting a mailed opt-out form, among other links. The specific opt out questioned here is the Marketing and Directory products opt-out method.

Step two: Consumers fill out the online form and submit it online. Note:The online form is not the opt out. The online form is simply a request for the company to mail the consumer an actual opt-out form. Filling out the online form does not opt the consumer out.

Step three: Acxiom mails the consumer the opt-out form/package.

Step four: The consumer receives the opt-out form, fills it out and mails it back to Acxiom.

The actual opt-out form is not provided to the consumer on the web page or site where the notice of opt-out is given.

Acxiom enables consumers to opt out of our marketing and directory information products. In addition, Acxiom allows consumers, when appropriate, the ability to access and correct the information found in our directory, fraud detection and prevention and background screening products.

Your Choices and How to Contact Us:

You may request to opt out of our marketing and directory products by submitting the completed request form here: Opt Out Request Form. To opt out of our online advertising solution Click Here

You may access and correct the information found in our directory and identity verification products for a processing fee of $5 by contacting us at referencereport@acxiom.com or calling 1-877-774-2094.

You may access and correct as appropriate the information found in our background screening products at no charge as prescribed by the Fair Credit Reporting Act by calling 1-800-853-3228, option 3.

The opt-out request form reads: (partial, for complete text see screen shot.)

OPT-OUT REQUEST FORM

To request removal of your contact information from Acxiom’s Marketing Information products, please submit the following information and an Opt-Out Request form will be mailed to you. Please sign and return the form and your request will be processed.

No use will be made of the information provided below other than to mail the Opt-Out package to you.

PublicRecordsNow values your right to privacy. If you would like to block your records from being shown on most search results, please send us a letter containing the following information:

a. First Name

b. Last Name

c. Middle Initial

d. Aliases and AKA’s

e. Complete current address

f. Complete former addresses, going back 20 years

g. Date of Birth – MM/DD/YYYY

With your letter, please include a print out of the records that you wish to have suppressed, and send both to:

Opt-Out/PublicRecordsNow.com

15332 Antioch St. #713

Los Angeles, CA 90272

Your information will always be kept confidential and will only be used to ensure the suppression of your records.

2. Screenshot of the PublicRecordsNow opt-out notice

Screenshot of the PublicRecordsNow opt-out notice:

Fig. 1.3. PublicRecordsNow opt-out notice, Recorded April 7, 2009.

C. US Search Opt Out

US Search requires consumers who have received an online notice only to opt out solely by paper mail. Although US Search has an online form consumers can fill in, thus sparing consumers from having to write their own letter, consumers must still mail the form in to a postal address.

1. Text of the US Search opt-out notice

What are my opt-out rights? Can you remove information about me from searches conducted on your Website?

US Search obtains most of the information for our products and services from partners who generally obtain it from public records. We do not maintain or control the public records, and we are unable to remove your name from any public records. However, we do offer a free “opt-out” service that prevents your name and address from appearing on most, although not all, searches conducted on USSearch.com. If you’d like to use our opt-out service, please click here to visit our opt-out page.

US Search obtains most of the information for our products and services from partners who generally obtain it from public records. We do not maintain or control the public records, and we are unable to remove your name from any public records. However, we do offer a free “opt-out” service that prevents your name and address from appearing on most, although not all, searches conducted on USSearch.com. This is a self opt-out service only. We do not process third party opt-out requests. If you would like to use our opt-out service, please follow the instructions below. Please note that if you do not follow these instructions exactly, we will not be able to honor your opt-out request.

Enter your information in the fields below. You should include every address where you’ve lived or received mail over the past 10 years.

To score is human. Ranking individuals by grades and other performance numbers is as old as human society. Consumer scores — numbers given to individuals to describe or predict their characteristics, habits, or predilections — are a modern day numeric shorthand that ranks, separates, sifts, and otherwise categorizes individuals and also predicts their potential future actions. This new report by Pam Dixon and Robert Gellman explores this issue of predictive scores and privacy.

This Jan. 30, 2014 report discusses a new right to restrict disclosure of health information under the updated HIPAA health privacy rule. The new provision called “Pay Out of Pocket,” also called the “Right to Restrict Disclosure” gives patients the right to request that their health care provider not report or disclose their information to their health plans when they pay for medical services in full. Navigating the new right will take effort and planning for patients to utilize effectively. This substance of this report is about the new patient right to restrict disclosure, and how patients can use it to protect health privacy.

This report focuses on government use of commercial data brokers, the implications for that usage, and what needs to be done to address privacy problems. The government must bring itself fully to heel in the area of privacy. If it is going to outsource its data needs to commercial data brokers, it needs to attach the privacy standards it would have been held to if it had collected the data itself. Outsourcing is not an excuse for evading privacy obligations. Report authors: Bob Gellman and Pam Dixon.